diff options
| author |   otto <otto@openbsd.org> | 2020-06-10 18:18:57 +0000 |
|---|---|---|
| committer | otto <otto@openbsd.org> | 2020-06-10 18:18:57 +0000 |
| commit | 58a47e53030fd89bd6452ab9a0967dab7bdb5c5c (patch) | |
| tree | 1adfa9322545b29b1b7dec40f626062de95537c2 | |
| parent | cwfg(4) (diff) | |
| download | wireguard-openbsd-58a47e53030fd89bd6452ab9a0967dab7bdb5c5c.tar.xz wireguard-openbsd-58a47e53030fd89bd6452ab9a0967dab7bdb5c5c.zip | |
Avoid out-of-bounds access when dumping (faulty) edid info; as seen
on my X1 6thg when it's docked. Root cause still to be determined.
ok kettenis@ jsg@
| -rw-r--r-- | sys/dev/pci/drm/drm_edid.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/sys/dev/pci/drm/drm_edid.c b/sys/dev/pci/drm/drm_edid.c index 72fc1b3418a..2e2267410c5 100644 --- a/sys/dev/pci/drm/drm_edid.c +++ b/sys/dev/pci/drm/drm_edid.c @@ -1807,6 +1807,9 @@ static void connector_bad_edid(struct drm_connector *connector, int i; u8 num_of_ext = edid[0x7e]; + if (num_of_ext > num_blocks) + num_of_ext = num_blocks; + /* Calculate real checksum for the last edid extension block data */ connector->real_edid_checksum = drm_edid_block_checksum(edid + num_of_ext * EDID_LENGTH); |